DEVELOPERS · API V1

Public API

A read-only REST API, aligned with the official MCP Registry style and built for AI agents — so harnesses, CLIs and agents can search and plug in directly. No auth required. Rate limit: 60 req/min per IP. CORS open (*).

Search plugins

GET https://www.pluginworld.ai/api/v1/plugins

qstringFull-text search: name, description, keywords, owner

ecosystemdsh | claude-code | mcpFilter by ecosystem

categorystringFilter by category, e.g. ai-agents

sortscore | stars | trending | updatedSort order — defaults to score (unified quality score)

pageintPage number, starting at 1

per_pageint ≤ 100Items per page, default 24

Example: find an AI code review plugin

curl "https://www.pluginworld.ai/api/v1/plugins?q=code+review&ecosystem=claude-code&sort=score"

Plugin details

GET /api/v1/plugins/{ecosystem}/{owner}/{name}
GET /api/v1/plugins/{ecosystem}/{owner}/{name}?include=readme

Returns full metadata, the raw manifest, per-ecosystem install commands (install[]) and the score breakdown.

curl "https://www.pluginworld.ai/api/v1/plugins/mcp/upstash/context7"

Market stats

GET /api/v1/stats

{
  "total_indexed": 1787,
  "by_ecosystem": { "dsh": 498, "claude-code": 496, "mcp": 793 },
  "source_totals": { "dsh": 11389, "claude-code": 5572, "mcp": 26612 },
  "categories": [{ "name": "ai-agents", "count": 1010 }],
  "last_synced_at": "2026-08-25T00:00:00Z"
}

Unified quality score

Every plugin gets a 0–100 score from five weighted dimensions, comparable across ecosystems:

maintenance0–30Commit recency decay (full within 30 days, 180-day half-life)

popularity0–25Star/download percentile within the ecosystem

compliance0–20Manifest passes the official ecosystem schema

security0–15License + install script static scan + owner verification

docs0–10README length, structure, code examples

Security rating

Every plugin passes a security scan before it is indexed, on every daily sync: install-script pattern matching, obfuscation signals, typosquat detection against popular names, suspicious URL checks (shorteners, raw IPs, punycode), leaked-secret detection and star-velocity anomaly analysis. The result is a letter grade, returned as security_grade:

A+TrustedZero findings and a verified publisher (official org, claimed owner, or official-registry listed)

ASafeZero findings: license present, spec-valid manifest, clean scan

BLow riskMinor findings only — e.g. missing license or manifest, isolated warnings

CCautionAccumulated warnings: suspicious URLs, leaked secrets (redacted), star-velocity anomalies

DBlockedCritical findings (malicious install scripts, typosquatting) — never listed; quarantined

Detail responses also include security_findings[] with each finding's id, severity and message.

Tips for AI agents

Recommended flow: search with q + ecosystem, take the top results by quality_score, then execute the install[] commands from the detail response. An MCP server wrapper (market_search / market_get tools) is on the roadmap (P2).

FAIR USE

All data comes from public metadata (GitHub API, the official MCP Registry); we index and link back to source repositories. API data is free to use — just credit pluginworld.ai.